A stranger buyer arrived with his family at the building where Matt Robb lives.
He hadn’t gone to the wrong place.
Nor did he find the address himself.
In his understanding, everything had already been agreed upon.
Whether the keyboard was still available, the price, and the pickup location—all had been discussed with someone via Facebook Marketplace.
The problem was:
The real seller, Robb, had no idea the transaction had progressed this far.
The person chatting with the buyer, providing pickup details, and arranging the visit was Meta’s AI agent—Muse.
At that time, Robb wasn’t even home.
He Just Wanted AI to Help Sell a Keyboard
Robb is a Canadian tech YouTuber.
He listed a Logitech MX Keys Mini keyboard on Facebook Marketplace and tried having Muse assist with the sale.
This is exactly why AI agents are so appealing.
You don’t have to constantly monitor messages yourself.
The AI can respond to inquiries, handle repetitive questions, and even guide the process to completion.
Robb also gave Muse the necessary transaction details, including the pickup location and other Marketplace communication content.
His understanding was:
Muse could handle parts of the dialogue for him.
But at crucial points—such as accepting offers, sharing sensitive info, or finalizing the deal—the AI would ask him again.
Things, however, did not unfold that way.
The Buyer Really Showed Up at His Building
A buyer inquired about the keyboard on Marketplace.
Muse continued communicating with the buyer on Robb’s behalf.
The buyer got the pickup address from the conversation and scheduled a visit.
When he arrived at Robb’s building with his wife and daughter, he even sent a message saying they had arrived.
But Robb wasn’t there.
What made it worse was that the buyer didn’t realize he had been communicating with AI all along.
He thought he was talking directly to the seller.
After waiting and not finding anyone, he even questioned why Robb would let him waste a trip if he didn’t want to sell.
Robb only found out afterward that Muse had pushed the transaction to this point.
But This Isn’t Simply “AI Leaking the Address Without Permission”
When the story surfaced, the first instinctive conclusion was:
Muse shared the user’s address with a stranger without permission.
But further investigation complicated matters.
Robb later revisited the permissions he had given Muse and found that two options had appeared on the system:
Allow One Time
and
Allow Always
He had chosen:
Allow Always.
Robb’s original understanding was:
“Let Muse keep handling my Marketplace tasks.”
But he expected important offers or sensitive operations to require his approval later.
In reality, that setting gave Muse longer-term permission to keep sending Marketplace messages on his behalf.
And the replies Muse crafted included the pickup address Robb had previously provided.
This created a gap in the understanding of what “allow” meant between the two sides.
The Real Issue: What Exactly Did You Allow?
The most noteworthy point isn’t whether Muse breached a technical boundary.
Meta’s later stance was:
Muse operated within the permissions Robb had already granted and did not bypass privacy controls to obtain his address.
Robb also admitted he did click Allow Always.
The problem was:
He thought he was authorizing “continue handling the work.”
But the product’s actual interpretation might be closer to:
“This type of message can be sent on your behalf from now on.”
These two phrases may sound similar.
But when the event actually happens, the difference is huge.
“Approve Once” and “Approve Always” Are Not the Same
AI agents increasingly offer multiple levels of authorization.
It might allow:
This one time only.
Or it might allow:
This session.
The entire task.
A specific time period.
Or continuous operation thereafter.
For those familiar with system permissions, these differences may be clear.
But for everyday users, seeing “Allow Always” may only mean:
“Don’t bother me with every small step.”
They might not realize that:
Actions they thought would always require confirmation could be included in that permission.
This is why this case is more important than just another “AI messed up” story.
Meta Now Emphasizes User Approval
Meta’s current official stance on Muse is that important actions remain under user control.
The Muse official page states that crucial activities like sending emails or making purchases can be reviewed and approved before execution.
Muse for Small Business explicitly says:
“Nothing publishes, sends, or spends without your approval.”
Muse also provides an audit trail so users can see what AI has done or intends to do.
However, this does not necessarily contradict Robb’s case.
The real question is:
Does approval mean “ask again for every important step,” or “previous continuous authorization counts as approval”?
If users expect the former but the product operates under the latter, even without a technical breach, the user experience can suffer serious gaps.
The Price Dispute Isn’t the Central Issue Here
Robb initially said Muse accepted an offer below his set minimum price.
Later clarifications revealed a display error:
Messages related to the $700 minimum price sometimes lost the initial "7," making the conversation show different prices.
Therefore, whether Muse actually accepted the $600 offer below the minimum is more complex than first portrayed.
But even leaving price out completely, the core of the story remains:
Robb gave ongoing authorization.
Muse used the provided pickup details.
The buyer obtained the address.
The buyer actually went to Robb’s building.
And Robb didn't know it was happening at the time.
Why Is This Especially Important Now?
Because Muse is no longer just an experimental tool to help with Marketplace transactions.
Meta is pushing Muse into real work environments.
Muse for Small Business can connect with QuickBooks, Shopify, Stripe, Slack, Notion, Asana, Zoom, and Facebook and Instagram business accounts.
AI agents will soon be handling more than:
“Help me find information.”
Tasks like:
Replying to emails.
Handling customers.
Updating store content.
Scheduling appointments.
Preparing payments.
Operating enterprise systems.
As agents gain access to more capabilities, the scope of their authorizations can no longer rely on users’ vague understanding.
What People Should Really Check Isn’t How Smart the AI Is
If you start handing your email, shopping, bookings, Marketplace transactions, or business tools over to an AI agent, one of the most important questions might not be:
“Will it be able to do it?”
But rather:
“When I click allow, how long does that allow last?”
At minimum, you should differentiate three types of actions:
Can be done automatically
Examples: organizing data, searching information, preparing drafts.
Must be confirmed each time
Examples: sending emails, accepting offers, modifying orders, sharing addresses, publishing content.
Must never be automatic
Examples: making payments, deleting important data, or sending highly sensitive information.
The real change AI agents bring is that for the first time we are entrusting software with broad “power to act on our behalf.”
So next time you see an approval prompt, don’t just ask:
“Allow or not?”
Look carefully:
“Is this permission for this one time only, or does it mean forever after without asking again?”
These two options could be the difference between “AI saving you several confirmation steps” and “a stranger showing up at your doorstep.”
Quick Checklist for AI Agent Permissions
If you have already started assigning an AI agent your email, bookings, shopping, or work tools, here is a simple three-tier checklist I put together:
Automatic / Confirm every time / Never automatic.
Comment “process” and use this AI Agent Permissions Three-Tier Checklist to review what permissions you’ve already given AI.
Recommended Reading
This article directly extends today’s core issue: when you see approval requests, besides “allow or deny,” also consider how long the authorization remains valid.
If you’re not familiar with Muse, start here to understand how it differs from typical chat AIs and exactly what it can do for users.
